[Security Solution] Tines connector #143505

semd · 2022-10-18T09:14:43Z

Summary

Issue: #140066
Doc: https://docs.google.com/document/d/14BY-6CIin1CUH5bwJJgfrGl37hWO-CeNMdl_35agpvk/edit?usp=sharing

Create a new connector type that offers low friction/low effort approach to augmenting Elastic capabilities with SOAR capabilities of Tines.

Implementation

Tines connector implements subActionConnector. With 4 subActions configured:

stories: Retrieves the User available Story objects from Tines, to render the Story selector options in the params form. It uses the email and token authentication headers from the configuration.
It is requested only when the form opens and when the connector instance changes.
webhooks: Retrieves the Story available Webhooks objects from Tines, to render the Webhook selector in the params form. It uses the email and token authentication headers from the configuration and the story_id parameter.
There is no filter for type in the actions (a.k.a. agents) endpoint, so we have to request all actions and filter them by type === 'Agents::WebhookAgent' on our side.
It is requested every time the selected story changes.
run: The main action execution. It sends the alerts to the Tines configured webhook, using webhook' path and secret values. There's no template to render, the data coming from the execution is just pruned (the kibana entry is removed from all context.alerts) and sent directly using the same format to Tines.
test: The test form execution. It ends up calling run but using a parametrized body.

Pagination

Both stories and webhooks subActions need pagination, since Tines do not expose any search endpoint for them. The current hard limit is 100 pages. The paginatedRequest function in the connector implementation encapsulates this logic.

Testing

1- Create a Tines free account.

2- Create a new Story and attach a Webhook Action to start receiving events.

3- Create an API token

4- Configure the Tines Connector in Kibana using the Tines tenant URL that has been generated in the Tines app, the email used to sign in, and the API token generated. docs

5- Attach the Tines Connector to a Detection Rule, selecting the Story and Webhooks created. docs

6- After each rule execution, events should appear in the Tines webhook action.

Screenshots

Configure a Tines connector

Use the Tines connector

Tines events

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios(https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))

…-fix'

… into 140066_tines_connector

elasticmachine · 2022-10-20T14:36:38Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

semd · 2022-10-24T09:46:43Z

@elasticmachine merge upstream

docs/management/action-types.asciidoc

cnasikas · 2022-11-08T17:41:51Z

docs/management/connectors/action-types/tines.asciidoc

@@ -0,0 +1,105 @@
+[role="xpack"]


cnasikas · 2022-11-08T18:09:19Z

x-pack/plugins/stack_connectors/server/connector_types/security/tines/index.ts

+    secrets: TinesSecretsSchema,
+  },
+  validators: [{ type: ValidatorType.CONFIG, validator: urlAllowListValidator('url') }],
+  supportedFeatureIds: [SecurityConnectorFeatureId],


@ymao1 Should not it show "Security solution"?

No, we are showing the feature ID category now, which is either Alerting Rules or Cases. Since this is available for Security rules, that falls under Alerting Rules

Oh, I was not aware of that. Thanks for clarifying!

cnasikas

Very good job with the connector @semd! I left some comments. I tested without any issues. I noticed that when the user first enters to the params form it show an error. This is a bit misleading because the user did not interact with the form yet. Other connectors do not show an error until the user interacts with the form.

x-pack/plugins/stack_connectors/server/connector_types/security/tines/tines.ts

cnasikas · 2022-11-09T10:51:53Z

x-pack/plugins/stack_connectors/public/connector_types/security/tines/tines_connector.tsx

+
+const { emptyField, urlField } = fieldValidators;
+
+const TinesActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({


I am not sure it fits your needs but you can use the SimpleConnectorForm defined here x-pack/plugins/triggers_actions_ui/public/application/components/simple_connector_form.tsx. You can see an example here x-pack/plugins/stack_connectors/public/connector_types/cases/jira/jira_connectors.tsx

x-pack/plugins/stack_connectors/public/connector_types/security/tines/tines_params.test.tsx

x-pack/plugins/stack_connectors/public/connector_types/security/tines/tines_params.tsx

x-pack/plugins/stack_connectors/server/connector_types/security/tines/tines.test.ts

x-pack/plugins/stack_connectors/server/connector_types/security/tines/tines.ts

x-pack/plugins/triggers_actions_ui/public/application/hooks/use_sub_action.test.tsx

x-pack/plugins/triggers_actions_ui/public/application/hooks/use_sub_action.tsx

cnasikas · 2022-11-09T12:00:08Z

...g_api_integration/security_and_spaces/group2/tests/actions/connector_types/security/tines.ts

+              data: tinesWebhookSuccessResponse,
+            });
+          });
+        });


We should add a test for testing the test sub action.

mikecote · 2022-11-09T12:32:37Z

FYI I just merged #144736 and this PR will require to add tines into the list within x-pack/test/alerting_api_integration/spaces_only/tests/actions/check_registered_connector_types.ts after pulling latest.

jonathan-buttner

Left a few questions. Tested the new changes and things look good though!

x-pack/plugins/stack_connectors/public/connector_types/security/tines/tines.ts

x-pack/plugins/stack_connectors/public/connector_types/security/tines/tines_connector.test.tsx

x-pack/plugins/stack_connectors/public/connector_types/security/tines/tines_params.tsx

...erting_api_integration/common/fixtures/plugins/actions_simulators/server/tines_simulation.ts

x-pack/test/functional/services/actions/tines.ts

x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/tines.ts

x-pack/plugins/stack_connectors/server/connector_types/security/tines/render.ts

x-pack/plugins/stack_connectors/public/connector_types/security/tines/translations.ts

.../test/alerting_api_integration/spaces_only/tests/actions/check_registered_connector_types.ts

stephmilovic

Reviewed the code and tested locally, all works as expected. This is a very interesting system, good job navigating it and writing this solution. Thanks @semd!

LGTM from Explore team!

YulNaumenko

Thank you a lot for such a great effort! Tested locally, connector works as described in the document. Code LGTM!

semd · 2022-11-10T17:40:36Z

@elastic/mlr-docs could you please take a look?

jonathan-buttner

Great work @semd !

x-pack/plugins/triggers_actions_ui/public/application/hooks/use_sub_action.test.tsx

semd · 2022-11-14T09:34:40Z

@elasticmachine merge upstream

kibana-ci · 2022-11-14T10:13:19Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`stackConnectors`	167	175	+8
`triggersActionsUi`	456	458	+2
total			+10

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`triggersActionsUi`	499	501	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`stackConnectors`	380.5KB	411.5KB	+31.1KB
`triggersActionsUi`	659.0KB	656.8KB	-2.1KB
total			+28.9KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`triggersActionsUi`	50	51	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`stackConnectors`	22.9KB	24.6KB	+1.7KB
`triggersActionsUi`	101.8KB	103.7KB	+2.0KB
total			+3.7KB

Unknown metric groups

API count

id	before	after	diff
`triggersActionsUi`	528	530	+2

async chunk count

id	before	after	diff
`stackConnectors`	55	59	+4

ESLint disabled in files

id	before	after	diff
`osquery`	1	2	+1

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	19	21	+2
`fleet`	59	65	+6
`osquery`	108	113	+5
`securitySolution`	441	447	+6
`stackConnectors`	74	78	+4
total			+23

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	20	22	+2
`fleet`	67	73	+6
`osquery`	109	115	+6
`securitySolution`	518	524	+6
`stackConnectors`	78	82	+4
total			+24

History

💚 Build #87263 succeeded 3e09fb1
💔 Build #87122 failed 0ffb5ea
💚 Build #86938 succeeded ae84937
💔 Build #86783 failed 36319b0
💔 Build #86599 failed 401478e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @semd

semd added 4 commits October 10, 2022 11:27

Tines sub action connector ininital imp

e2d69c2

conflicts solved

b76d10b

useSubAction prevent loading active when disabled

3ce6215

tines params form small bugs fixed

9b9267c

semd added Team:Threat Hunting Security Solution Threat Hunting Team release_note:feature Makes this part of the condensed release notes Feature:Actions/ConnectorTypes Issues related to specific Connector Types on the Actions Framework Team:Threat Hunting:Explore v8.6.0 labels Oct 18, 2022

semd self-assigned this Oct 18, 2022

semd and others added 7 commits October 18, 2022 11:28

conflicts solved

ef4585e

tines server tests

83faff6

remove dedup

502d18c

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

142725c

…-fix'

tests added

e817fd8

Merge branch '140066_tines_connector' of https://github.com/semd/kibana…

1dbd386

… into 140066_tines_connector

more unit tests

89e9c8c

semd marked this pull request as ready for review October 20, 2022 14:36

semd requested a review from a team as a code owner October 20, 2022 14:36

semd added 5 commits October 20, 2022 17:20

fix translation key

de49820

Merge remote-tracking branch 'upstream/main' into 140066_tines_connector

c507b14

translation key fixed

8e79963

format

0d6fde1

Tines docs

7e2485b

semd requested a review from a team as a code owner October 20, 2022 17:12

docs images

aad5d97

kibanamachine and others added 2 commits October 24, 2022 05:46

Merge branch 'main' into 140066_tines_connector

933dbf6

fix asciidoc warning

ac5d977

cnasikas reviewed Nov 8, 2022

View reviewed changes

docs/management/action-types.asciidoc Show resolved Hide resolved

cnasikas reviewed Nov 8, 2022

View reviewed changes

docs/management/connectors/action-types/tines.asciidoc

@@ -0,0 +1,105 @@

[role="xpack"]

Copy link

Member

cnasikas Nov 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @lcawl

cnasikas reviewed Nov 8, 2022

View reviewed changes

cnasikas reviewed Nov 9, 2022

View reviewed changes

functional UI test

401478e

semd added 5 commits November 9, 2022 15:20

Merge remote-tracking branch 'upstream/main' into 140066_tines_connector

46e3a38

Merge remote-tracking branch 'upstream/main' into 140066_tines_connector

d0643fe

use SimpleConnectorForm

506ef79

create per_page parameter constant

82b79d0

adapt server simulator on functional tests

36319b0

jonathan-buttner reviewed Nov 9, 2022

View reviewed changes

stephmilovic reviewed Nov 9, 2022

View reviewed changes

x-pack/plugins/stack_connectors/public/connector_types/security/tines/translations.ts Outdated Show resolved Hide resolved

stephmilovic reviewed Nov 10, 2022

View reviewed changes

x-pack/plugins/stack_connectors/public/connector_types/security/tines/translations.ts Outdated Show resolved Hide resolved

stephmilovic reviewed Nov 10, 2022

View reviewed changes

.../test/alerting_api_integration/spaces_only/tests/actions/check_registered_connector_types.ts Outdated Show resolved Hide resolved

stephmilovic approved these changes Nov 10, 2022

View reviewed changes

YulNaumenko approved these changes Nov 10, 2022

View reviewed changes

semd added 2 commits November 10, 2022 11:17

fix test xsrf.allowlist for tines

ae84937

pr fixes

d085f42

review changes

0ffb5ea

jonathan-buttner approved these changes Nov 10, 2022

View reviewed changes

x-pack/plugins/triggers_actions_ui/public/application/hooks/use_sub_action.test.tsx Outdated Show resolved Hide resolved

semd added 2 commits November 11, 2022 11:42

linter

8487314

Merge remote-tracking branch 'upstream/main' into 140066_tines_connector

3e09fb1

Merge branch 'main' into 140066_tines_connector

cb1834c

semd merged commit 6bba30f into elastic:main Nov 14, 2022

nastasha-solomon mentioned this pull request Nov 14, 2022

[DOCS] Tines connector elastic/security-docs#2689

Closed

nastasha-solomon mentioned this pull request Jan 5, 2023

[DOCS] What's new in 8.6 elastic/security-docs#2758

Closed

20 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Tines connector #143505

[Security Solution] Tines connector #143505

semd commented Oct 18, 2022 •

edited

Loading

elasticmachine commented Oct 20, 2022

semd commented Oct 24, 2022

cnasikas Nov 8, 2022

cnasikas Nov 8, 2022

ymao1 Nov 10, 2022

cnasikas Nov 10, 2022

cnasikas left a comment

cnasikas Nov 9, 2022 •

edited

Loading

cnasikas Nov 9, 2022

mikecote commented Nov 9, 2022

jonathan-buttner left a comment

stephmilovic left a comment

YulNaumenko left a comment

semd commented Nov 10, 2022

jonathan-buttner left a comment

semd commented Nov 14, 2022

kibana-ci commented Nov 14, 2022 •

edited

Loading

API count

async chunk count

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count


		const { emptyField, urlField } = fieldValidators;

		const TinesActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({

[Security Solution] Tines connector #143505

[Security Solution] Tines connector #143505

Conversation

semd commented Oct 18, 2022 • edited Loading

Summary

Implementation

Pagination

Testing

Screenshots

Checklist

elasticmachine commented Oct 20, 2022

semd commented Oct 24, 2022

cnasikas Nov 8, 2022

Choose a reason for hiding this comment

cnasikas Nov 8, 2022

Choose a reason for hiding this comment

ymao1 Nov 10, 2022

Choose a reason for hiding this comment

cnasikas Nov 10, 2022

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

cnasikas Nov 9, 2022 • edited Loading

Choose a reason for hiding this comment

cnasikas Nov 9, 2022

Choose a reason for hiding this comment

mikecote commented Nov 9, 2022

jonathan-buttner left a comment

Choose a reason for hiding this comment

stephmilovic left a comment

Choose a reason for hiding this comment

YulNaumenko left a comment

Choose a reason for hiding this comment

semd commented Nov 10, 2022

jonathan-buttner left a comment

Choose a reason for hiding this comment

semd commented Nov 14, 2022

kibana-ci commented Nov 14, 2022 • edited Loading

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

async chunk count

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

History

semd commented Oct 18, 2022 •

edited

Loading

cnasikas Nov 9, 2022 •

edited

Loading

kibana-ci commented Nov 14, 2022 •

edited

Loading